This vulnerability involves a type confusion flaw in PostgreSQL's pg_restore_attribute_stats() function. Specifically, the conflation of range and multirange values can be exploited by an object creator to execute arbitrary code with the privileges of the OS user running the database process. The issue affects PostgreSQL major version 18, minor versions before 18.5. No affected versions prior to 18 are impacted.

Successful exploitation allows an attacker with object creation privileges to execute arbitrary code on the operating system with the same privileges as the database server process. This can lead to full compromise of the database host under the database user context. The CVSS 3.1 base score is 8.8, reflecting high impact on confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict object creation privileges to trusted users only to reduce risk.